SAP Extended Application Services And Runtime vulnerabilities

2 CVEs affecting SAP Extended Application Services And Runtime, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-40309, published 2023-09-12.

More from SAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-40309, published 2023-09-12. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges.…
• CVE-2023-40308, published 2023-09-12. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component…